# AI Visibility Map: blank template

What AI is running in your environment, and which tool can actually see it.

| Field | Value |
|---|---|
| Prepared by |  |
| Date |  |
| Version | v0.1 |

**Scope:** _Describe your estate: approved AI services, number of endpoints and servers, cloud footprint, tenants, and any OT or industrial segments._

## How to use

Each cell asks one question: which tool tells you this AI asset exists here, and what it is doing? Name the tool, then set coverage. Empty or None cells are your blind spots. Coverage means you can discover the asset, see what it does, and keep the evidence. A tool that only blocks, with no inventory or logging, is Partial.

Sanctioned versus shadow is the column axis: SaaS - Internal is the AI you license and approved, SaaS - External / Shadow is everything reached over the network. The governance band at the foot asks whether any of it is approved, audited and enforceable.

- Every cell scored Full, Partial or None must name the tool that provides it. A score with no tool is not coverage.
- Start the tool name with "?" when the tool is deployed and could cover the cell but nobody has confirmed it. Leave those cells Unknown until someone checks.

## Coverage at a glance

| AI asset class | On-premises | Cloud platforms | SaaS - Internal | SaaS - External / Shadow |
|---|---|---|---|---|
| 01 Models and model endpoints | Unknown | Unknown | Unknown | Unknown |
| 02 Agents and copilots | Unknown | Unknown | Unknown | Unknown |
| 03 MCP servers and tool connectors | Unknown | Unknown | Unknown | Unknown |
| 04 AI pipelines and data flows | Unknown | Unknown | Unknown | Unknown |
| 05 AI tooling, runtimes and supply chain | Unknown | Unknown | Unknown | Unknown |
| GOV Governance and assurance | Unknown | Unknown | Unknown | Unknown |

## The map

### 01 Models and model endpoints

_Which models run or are called, by whom, and with what data?_

| Environment | What to look for | Visibility tool(s) | Coverage |
|---|---|---|---|
| On-premises | Workstations: local runtimes (Ollama, LM Studio, llama.cpp), model weight files on disk, listeners on :11434 / :1234, sustained GPU use. Engineering workstations on OT or industrial segments are a common blind spot. Servers: self-hosted inference (vLLM, Triton, TGI), model registries, GPU nodes, internal model API endpoints, including dev servers calling AI APIs. |  | Unknown |
| Cloud platforms | Managed model deployments (Azure OpenAI, AWS Bedrock, Vertex AI), including AI services stood up in unsanctioned subscriptions or accounts; model catalogue use; endpoint keys; quota and spend as a discovery signal. |  | Unknown |
| SaaS - Internal | Models embedded in the SaaS you license (the copilot's grounding model, vendor sub-processor models); model version, hosting region, tenant data boundary. |  | Unknown |
| SaaS - External / Shadow | Outbound calls to model APIs (api.openai.com, api.anthropic.com, generativelanguage.googleapis.com); API keys held or funded outside central management. |  | Unknown |

### 02 Agents and copilots

_What acts on its own, under whose identity, with what permissions?_

| Environment | What to look for | Visibility tool(s) | Coverage |
|---|---|---|---|
| On-premises | Workstations: desktop and coding agents (CLI / IDE), browser-driving agents, scheduled agent jobs (cron, Task Scheduler). Servers: agent runtimes and orchestrators (LangGraph, n8n, AutoGen), daemons and containers, service accounts running agent workloads. |  | Unknown |
| Cloud platforms | Cloud agent services (Azure AI Foundry, Bedrock Agents, Vertex AI Agent Builder); agent non-human and workload identities; roles assumed and actions written to cloud audit logs. |  | Unknown |
| SaaS - Internal | Copilots and agent builders in your suite (for example Microsoft 365 Copilot and Copilot Studio), including maker-built agents and flows published by end users; who published each one, and what knowledge and connectors it holds. |  | Unknown |
| SaaS - External / Shadow | Third-party agent platforms reached over the web; browser agents acting on corporate sessions; OAuth grants letting an external agent act inside your tenant. |  | Unknown |

### 03 MCP servers and tool connectors

_What can an AI reach into, and who approved that connection?_

| Environment | What to look for | Visibility tool(s) | Coverage |
|---|---|---|---|
| On-premises | Workstations: local stdio MCP processes, .mcp.json and client config files, MCP containers, IDE extensions that add connectors. Servers: self-hosted remote MCP endpoints (HTTP / SSE), container images, exposed ports, credentials stored in server-side MCP config. |  | Unknown |
| Cloud platforms | Hosted MCP services; API gateway routes in front of MCP; secrets issued to MCP clients; consented enterprise applications. |  | Unknown |
| SaaS - Internal | Vendor-supplied MCP connectors inside licensed SaaS; platform connectors (for example Graph or Power Platform) exposed to copilots; scope grants that widen what an agent can read. |  | Unknown |
| SaaS - External / Shadow | Desktop and IDE clients connecting to remote MCP endpoints on the internet; egress to MCP / SSE endpoints; tokens issued to external MCP servers. |  | Unknown |

### 04 AI pipelines and data flows

_Where does your data go to be embedded, trained on, or retrieved?_

| Environment | What to look for | Visibility tool(s) | Coverage |
|---|---|---|---|
| On-premises | Workstations: notebooks, local RAG indexes, local vector stores, bulk data pulled down for embedding. Servers: ETL into vector databases, fine-tune jobs, feature stores. Exports from OT or industrial data stores staged for analytics are often the highest-value data at risk. |  | Unknown |
| Cloud platforms | ML pipelines (Azure ML, SageMaker, Vertex AI); managed vector stores; training data in object storage; cross-region data movement. |  | Unknown |
| SaaS - Internal | Copilot and vendor RAG indexing your documents, mail and ticket data; semantic index scope; retention and data-residency terms. |  | Unknown |
| SaaS - External / Shadow | Corporate data pasted or uploaded to external AI sites; file uploads to AI services; whether prompts and documents are used for vendor model training. |  | Unknown |

### 05 AI tooling, runtimes and supply chain

_What AI code and dependencies are installed, and can you trust them?_

| Environment | What to look for | Visibility tool(s) | Coverage |
|---|---|---|---|
| On-premises | Workstations: pip / npm AI packages, IDE and browser AI extensions, desktop AI apps installed outside the software catalogue, CUDA and driver stack. Servers: container base images carrying AI libraries, SBOM coverage, CVEs in AI / ML dependencies, hard-coded API keys, models pulled from public hubs. |  | Unknown |
| Cloud platforms | Managed notebook images; marketplace images; IaC (Terraform, Bicep, CloudFormation) declaring AI services; CI/CD steps calling models. |  | Unknown |
| SaaS - Internal | AI features silently enabled inside licensed SaaS; vendor change notices that turn AI on by default; sub-processor list and contractual AI terms. |  | Unknown |
| SaaS - External / Shadow | Unvetted AI plugins and marketplace installs; model and package pulls from public hubs; extensions and desktop apps that call external AI at runtime. |  | Unknown |

### GOV Governance and assurance

_For whatever runs here: is it approved, is it audited, and can you enforce policy?_

| Environment | What to look for | Visibility tool(s) | Coverage |
|---|---|---|---|
| On-premises | Workstations: approved-software catalogue for AI tools, SSO session activity, version and patch state of approved AI clients. Servers: server-side integrations and webhooks to approved AI services, service principals used by automation, key custody. |  | Unknown |
| Cloud platforms | Subscription or account policy and entitlements; private endpoints; enterprise policy and content-filter configuration. |  | Unknown |
| SaaS - Internal | Approved-app register; copilot and agent audit logs shipped to the SIEM; DLP and sensitivity-label enforcement on AI surfaces; licence and seat inventory. |  | Unknown |
| SaaS - External / Shadow | Unless your policy approves it, nothing here is sanctioned, so can you detect and enforce? Tenant restrictions and SSO enforcement; free-tier signups with corporate email; personal AI accounts on corporate devices. |  | Unknown |

## Tool register

One row per tool that gives you AI visibility today. If a tool's logs do not reach the SIEM, its coverage is Partial no matter how good the tool is.

| Tool / product | Vendor | Type of signal | Environment | Map rows covered | Depth | Logs to SIEM | Known blind spot / gap | Owner |
|---|---|---|---|---|---|---|---|---|
|  |  |  |  |  |  |  |  |  |
|  |  |  |  |  |  |  |  |  |
|  |  |  |  |  |  |  |  |  |
|  |  |  |  |  |  |  |  |  |
|  |  |  |  |  |  |  |  |  |
|  |  |  |  |  |  |  |  |  |

## Blind spots to close

Every None and every empty cell on the map becomes a gap with an owner and a target date.

| # | Gap / blind spot | AI asset class | Environment | Proposed tool or approach | Owner | Target date | Status |
|---|---|---|---|---|---|---|---|
| 1 |  |  |  |  |  |  |  |
| 2 |  |  |  |  |  |  |  |
| 3 |  |  |  |  |  |  |  |
| 4 |  |  |  |  |  |  |  |
| 5 |  |  |  |  |  |  |  |
| 6 |  |  |  |  |  |  |  |

## Decisions requested

| # | Decision | Owner | By when |
|---|---|---|---|
| 1 |  |  |  |
| 2 |  |  |  |
| 3 |  |  |  |
| 4 |  |  |  |
| 5 |  |  |  |

## How to score

| Coverage | Meaning |
|---|---|
| Full | Discovered, monitored, and the logs land in the SIEM |
| Partial | Some assets or some signal only |
| None | Confirmed blind spot |
| Unknown | Not assessed yet, or the tool is unverified |

- Every cell scored Full, Partial or None must name the tool that provides it. A score with no tool is not coverage.
- Start the tool name with "?" when the tool is deployed and could cover the cell but nobody has confirmed it. Leave those cells Unknown until someone checks.
- Coverage means you can discover the asset, see what it does, and keep the evidence. A tool that only blocks, with no inventory or logging, is Partial.
- If a tool's logs do not reach the SIEM, its coverage is Partial no matter how good the tool is.
- Score = (Full + half of Partial) / cells assessed. Unknown cells are left out of the score, so a map full of Unknowns is not a good score, it is an unfinished map.

| Depth | Meaning |
|---|---|
| Discover | Sees that the asset exists |
| Detect | Sees what the asset is doing |
| Control | Can stop or restrict it |

### Steps

1. **Set the scope.** Write one paragraph: which AI services are approved, the size of the estate, cloud footprint, tenants, and any OT or industrial segments.
2. **List your tools.** Fill the tool register with every tool that could give AI visibility today: endpoint, network, identity, cloud posture, SaaS audit, SIEM.
3. **Map tools to cells.** For each cell, name the tool that answers its question. Use "?" for tools that are deployed but not verified.
4. **Score each cell.** Full, Partial, None or Unknown. A score needs a named tool.
5. **List the blind spots.** Every None and every empty cell becomes a gap with an owner and a target date.
6. **Ask for decisions.** Take the few decisions only leadership can make to the next meeting.
7. **Re-score.** Set a date to score the map again. Coverage drifts as fast as AI adoption does.

---

Blue Marshal, bluemarshal.dev | framework v0.1.0